Implement Manifest Parser for OpenSSF GUAC

[melotic]

Graph for Understanding Artifact Composition (GUAC) aggregates software security metadata into a high fidelity graph database—normalizing entity identities and mapping standard relationships between them. Querying this graph can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance. ¹

Since CD has graph output from our Manifest, integrating CD into GUAC is very attractive for them. They would like us to help contribute a parser in Go that can parse our manifest file.

We should also consider #570 to ensure a stable contract.

Tasks

Preview Give feedback

1. Create JSON Schema For Manifest
2. Update verification tests to verify the contract of bcde-manifest.json #570
   status:requirements type:ci +2

Footnotes

1. https://github.com/guacsec/guac ↩